Twitter Phishing Campaign Spreading Via Direct Messages

I got the impression that lately the amount of phishing attacks via social media was not as great as we have seen in the past. But just as I logged in to Twitter today I noticed that I had received two direct messages, and they both had a very similar message.

Two days ago I received the first message, and when I tried to verify if it was a link spreading malware, or a phishing site, the URL was already inactive. Now when I received another one I wanted to look at it quickly, and at the time of writing the phishing site is still active.

The two messages which I received had more or less the same structure, the only difference is the choice of URL shortener, and a word which has been replaced. The two different URL shorteners were and

“hey, someone is spreading nasty rumours about you URL”

“hey, someone is spreading terrible rumours about you URL”

What happens if you click the URL which is in the message? You will be redirected to the website http://twi[CUT] where the attacker has created a rogue Twitter login-page, and if you enter your credentials they will end up in the wrong hands. The stolen credentials will most likely be used to find more victims, but also to maybe find victims on other social media.

After the victims has entered their credentials they will be redirected to a website giving them a fake “404” error code page. Just after 2 seconds the victim will then be redirected to the real Twitter login page.

In the first message I got, the shortened URL redirected to a domain very similar to the one being exploited in the new campaign I’m writing about now. The domain in the previous message was This is an indication that its the same people behind the campaigns.

Fellow researchers at Kaspersky Lab have also seen indications that a wave of phishing attacks are being aimed at Facebook. Whether or not the two campaigns are related is at this time impossible to say. Some screenshots of the Facebook campaign can be found below:

Fellow researchers at Kaspersky Lab have also indications that a wave of phishing attacks are being exploited at Facebook, if the two campaigns are related is at the time impossible to say. Some screenshot of the Facebook campaign can be found below:

At the moment we are working on collecting more URL’s in this campaign, if you are aware of any URLs, do not hesitate to contact us. You can contact me on Twitter by tagging @JacobyDavid

Also remember to be very careful when you enter your personal credentials on any site.

Twitter Phishing Campaign Spreading Via Direct Messages

Your email address will not be published. Required fields are marked *



APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox